little fix in password length validation